Most first audit timelines are planned from the wrong end. Someone picks a kickoff date, and the report date falls wherever the work happens to land. Then a sales team that promised a report by a certain quarter learns the date was never reachable.
A better plan starts from the date the report or certificate has to exist and works backward through the steps that cannot be compressed. This article sets out those steps for a first SOC 2 report and a first ISO 27001 certification, what each step waits on, and where first plans usually slip.
Start with the date someone actually needs
Ask the people pushing for the audit what they need, and by when. The answers are often different from what was assumed.
One prospect's security team may accept a SOC 2 Type I report, or a completed questionnaire, while a Type II is underway. Another may insist on a Type II covering a period of operation, which takes calendar time that no effort can shorten. An enterprise buyer in Europe may ask for an ISO 27001 certificate specifically.
Write down three things before planning anything else:
The deliverable. SOC 2 Type I, SOC 2 Type II, or an ISO 27001 certificate.
The date it is needed, and who said so. A named customer and a contract date, not "sales thinks Q3".
What would carry you until then. A Type I, a bridge to a report already in progress, or answers to the buyer's questionnaire.
The third answer often turns an impossible date into a manageable one.
The steps that cannot be compressed
Most of the work in a first audit goes faster with more people. A few steps do not, and they set the shape of the whole plan.
SOC 2 Type II: the observation period
The observation period is calendar time. Your controls have to operate across all of it, and the auditor tests samples drawn from across all of it. A first Type II often covers a shorter window than later reports, commonly three to six months. Later reports usually move to 12 months, back to back, so coverage has no gaps. The AICPA's guidance does not fix one minimum, and firms differ on the shortest period they will accept, so confirm it with yours before you plan around it.
Final fieldwork happens after the period ends. The report follows once the firm has finished testing and its own quality review. How long that takes depends on the firm and on how quickly you answer its requests. Some firms also run interim testing partway through the period, which spreads the work out.
Annual controls are the trap. A risk assessment, a penetration test, security awareness training, vendor reviews, and the yearly policy review must each happen inside the period if the auditor is to test them. With a three-month window, all of them have to land inside those three months.
ISO 27001: the management system has to run
ISO 27001 has no observation period in the SOC 2 sense. It has a sequence the certification body checks instead. The management system has to have run long enough to produce records. Certification bodies also expect at least one internal audit and one management review to be complete before Stage 2, and some ask to see them at Stage 1.
Stage 1 reviews your documentation and whether you are ready. Stage 2 tests whether the ISMS is implemented and working. The gap between them depends on what Stage 1 finds and on the auditor's availability, and some certification bodies set a maximum interval. After Stage 2, major nonconformities must be corrected before the certification decision, which goes through the certification body's own review.
A dependency map, not a Gantt chart
Dates are easier to defend when every step names what it waits on. A table like this does more work in the first planning meeting than a chart full of bars.
| Step | Waits on | Usual owner |
|---|---|---|
| Scope decision | The deliverable and the date | Compliance lead, engineering lead |
| Readiness or gap assessment | Scope | Compliance lead, sometimes an advisor |
| Auditor or certification body engaged | Scope, approximate dates | Compliance lead, finance |
| Policies approved | Gap assessment | Policy owners, leadership |
| Gaps remediated | Gap assessment | Control owners |
| Period starts (SOC 2) or ISMS operating (ISO) | Policies approved, controls running | Compliance lead |
| Annual controls performed | Period started | Control owners |
| Internal audit and management review (ISO) | ISMS operating | Internal auditor, top management |
| Fieldwork or Stage 2 | Period ended, or internal audit done | Auditor, your coordinator |
| Report or certificate issued | Fieldwork, firm's review | Auditor |
Two rows deserve a second look. Engaging the auditor sits early because firms book fieldwork well in advance, and a first-time client asking for fieldwork next month may not get it. Remediation comes before the period starts, not alongside it. A control fixed halfway through an observation window only has half a window of evidence, and the report will show it.
Where first timelines slip
The slips are predictable, which means you can plan for them.
Scope grows after the gap assessment. Someone adds a second product or a new region, and each addition brings systems, people and vendors with it. Record the scope decision in writing, and treat any change as a reason to replan.
Policy approval takes longer than policy writing. Drafting is quick. Getting each policy reviewed and approved by someone with the authority to approve it is not.
Remediation loses to roadmap work. Gaps assigned to engineering sit in a backlog behind features. Give each gap a named owner and a due date, and review the list weekly.
The coordinator is part-time. Someone has to own the request list during fieldwork. If that person also has a full-time role, fieldwork stretches.
Annual controls are forgotten. Teams discover late in the period that the penetration test was never booked.
A worked example
Say a 40-person SaaS company learns that a prospect needs a SOC 2 Type II, and the prospect will accept a Type I in the meantime. The compliance lead plans backward from the prospect's date:
Agree scope: the production platform and the corporate systems that support it, and nothing else.
Run a readiness assessment against the trust services criteria in scope.
Engage a firm, and agree a provisional Type I date and Type II period.
Remediate the gaps, and run each control at least once before the Type I date.
Obtain the Type I report, which covers design at a point in time.
Start the Type II period on or soon after the Type I date, with every control already running.
Put every annual control on the calendar in the first half of the period.
Close the period, support fieldwork, and receive the report.
The Type I is not wasted work. The auditor examines the same design the Type II relies on, and the prospect has something to review while the period runs. Whether a Type I first is worth it depends on what your buyers accept. Some teams go straight to a Type II and use the readiness work to answer questionnaires in the meantime.
How TrustLynce helps
The auditor portal keeps auditor requests, evidence and findings in one place, so fieldwork runs against a shared list instead of several inboxes. The readiness dashboard shows the gap analysis per framework that the rest of your timeline depends on.